Trezor warning about new wave of fraudulent emails.

[Lida93]

And also adding passphrase is to protect the wallet in case the seedphrase is known
Doesn't mean much when the attacker is with you and knows you own an hardware wallet.

They need your passphrase to access your real  Trezor wallet  unless you have none.  

what I’m recommending in my first post is setting the one they can easily access without passphrase or extra wallet with a different passphrase as decoy [ I will even recommended going for upto 2 decoy incase they aren’t satisfied and threatens you]..

Sacrificing few hundreds to thousand(s) while you still have your tens to hundreds of thousands worth of bitcoin safe with a passphrase is worth than just allowing them take everything you have.

I read your first post and I think I agree with it and this too, it's a good decoy mechanism to employ in securing our huge funds at the expense of an insignificant amount. Imo, It's with high possibility of saving the bitcoin owner's life when attacked by anyone who may know about the person owning some bitcoin in wallet. At least they need something to go away with, so the decoy wallet can save the day than just trying to convince the attacker about not having any bitcoin, something he already knows you do but just doesn't know how much quantity of bitcoin you own.

[boyptc]

We are under the attack right now, there is this online and phishing attacks, and then the physical $5 wrench attack. So right now, we are at the mercy of this criminals. It's good that Trezor might have issues this kind of warning to us.

We've always been under attack by these criminals, scammers, hackers, fraudsters.

So now it feel on everyone to be very vigilant, review the best security practices and hardened it as much as we can. Don't put your mnemonic seed in any apps that ask for it. Don't use Google to search for like Trezor or Ledger update as the Big G doesn't care. As long as this scammers are paying, they will put the ads on the first page so better watch out.

And never entertain emails that you are not aware of. If you're not familiar with it, ignore but if you are then check the source if it's from official sender.

It pays well to be aware of the official channels, emails, domains and other links related to trezor and other hardware wallets.

Verify always.

[Z-tight]

I wouldn't say "cryptocurrencies" I think rather Bitcoin self-custody is under attack but you can call me a conspiracy theorist or whatever.

Conspiracy theorist, lol.

Joking aside, i wouldn't necessarily say or think that BTC self-custody is under any 'special' or 'calculated' kind of attack. I think it is exactly what it has always been, and that is, if you have something valuable, bad actors would try to steal it. If Coinkite were not so full of shit as to allow such a silly mistake into their system, Coldcard users would have been fine, but as long as there is a backdoor, even if it existed 10 years ago, there is always a possibility it would be exploited.

[promise444c5]

it's a good decoy mechanism to employ in securing our huge funds at the expense of an insignificant amount. Imo, It's with high possibility of saving the bitcoin owner's life when attacked by anyone who may know about the person owning some bitcoin in wallet. At least they need something to go away with, so the decoy wallet can save the day than just trying to convince the attacker about not having any bitcoin, something he already knows you do but just doesn't know how much quantity of bitcoin you own.

Yeah.. you must be always a step ahead.. But, using such method must have a no  relationship with your real bitcoin [i.e there must be no on chain traces linking directly to your real bitcoin address].. That could actually make them suspicious even if they aren’t sure when they check and  noticed the address is just dormant.

The method can only fail  when they know the exact amount their victim owns.. and that’s why some type of privacy really matters.

[greysonz]

Thank you for providing the link. I apologize to everyone for not having done this myself earlier.

You can still add it or make the image clickable.

Done, thanks for advice

[Ashawowo(OS)]

Trezor in X is warning about a new wave of fraudulent emails. Apparently, the scammers have decided to play on the fears of those who haven’t yet heard about what happened with ColdCard. The scheme involves sending emails in which the scammers claim that trezor users need to update their firmware because “there is currently low entropy in the wallets.” I understand how naive this scam looks, but if you consider that there are people who haven’t heard about the entropy issue in ColdCard’s code, they might find this “vulnerability” of their wallets quite serious.

What do we expect after the sensitive data breach, phishing attacks would follow and would they succeed? Of course they would catch so many people off-guard, especially older and less tech-savvy people.

They've people's data now, down to their home addresses, so we may likely see fraudulent mails delivered to their doorsteps or even a wave of wrench attacks on Trezor users, particularly those living in France

[oll]

Trezor in X is warning about a new wave of fraudulent emails.

If I understand correctly, the attackers used some kind of leak from the Trezor client database, and this is not the first time this has happened. But all the same, their attempts in 2026 to try to deceive one of the owners of Trezor look as naive as possible. Attackers have been sending such emails since time immemorial, and I want to say that I still understand why they are trying their luck at this. Now all the security systems are already incredibly advanced, but trying to trick a person is the only possible way to get his assets at such a time.

[Alpha Marine]

This is why it's good to have basic knowledge of things like this, because it's pretty obvious that no service will send you an email where you're required to change or update your seed phrase or anything like that. A fake email to a fake website is a red flag enough for anybody.
Everybody receives phishing emails, but they're easy to spot. You don't need to know everything about everything to be able to spot scams. Any email or person that is asking you for details that only you should have is a scam. Nobody needs your passwords or seed phrase for anything in any update.

[Z-tight]

This is why it's good to have basic knowledge of things like this, because it's pretty obvious that no service will send you an email where you're required to change or update your seed phrase or anything like that.

There is no such thing as a seed phrase update and that is not what the scam is about, the scammers are not stupid. This is about a so-called firmware vulnerability, that would require a firmware update. The scammers would include a link in the email that would ask the recipient to enter their seed phrase to update, you already know what would happen if they are gullible enough to type their seed online.

Any email or person that is asking you for details that only you should have is a scam. Nobody needs your passwords or seed phrase for anything in any update.

True, i feel sorry for victims of phishing scams. But sometimes it is so easy to spot that i am genuinely curious how people miss it and still fall for it, especially when you have 5 figures or more in your wallet.

[SamReomo]

The scammers always try to find new ways to scam users to loot their money especially their Bitcoin. Those tactics will continue to change overtime because scammers are getting smarter nowadays and that's why they could use such updated tactics. I think we don't really need hardware wallets like Trezor these days, the safest way to store your Bitcoin is to go for an air gaped system and use Electrum cold wallet there to be on safest end. Hardware wallet users have lost a lot because of the scammers that's why I think it's better to move on and start using open source software wallets like Electrum.

[KiaKia]

Are people still acting on emails they received from scammers? What happened to verifying first? If something happens to Trezor hardware wallet then verify first, message the team yourself by going to their official website and contact them.

This is why I always advice people who aren't tech savvy to avoid crypto, because they will give in to any available texts or messages from strangers online, I've been there with some beginners and they screamed how the hell they will know which is real or not.

Don't just talk to strangers, if you get message via email from any company always verify first, don't click any links, these advices are heavy for a lot of people, it's better if they don't get involved.

[suzanne5223]

I think this topic will be better in the beginner and help section, based on what was stated in the Trezor X about the fraudulent emails and the strategy used by the scammers claiming Trezor users need to upgrade their firmware because the current entropy in the wallets is low.
I believe only newbies who didn't do research or understand the entropy used by Trezor will fall for the trick, and this trick is inevitable for all newbies now and in the future.

[Sunshine1525]

Are people still acting on emails they received from scammers? What happened to verifying first? If something happens to Trezor hardware wallet then verify first, message the team yourself by going to their official website and contact them.

Don't just talk to strangers, if you get message via email from any company always verify first, don't click any links, these advices are heavy for a lot of people, it's better if they don't get involved.

You're right to a good extent, the internet is not a very safe place and filled with lots of scammers seeking the vulnerable so instead of believing anything it's better to verify first. Imagine getting a random call or text from a random person, telling you that your Dad said you should send a family land document to his address and you foolishly send it to the person without verifying from your Dad, that's how people who faild to verify first would foolishly expose themselves to scammers.

This is why I always advice people who aren't tech savvy to avoid crypto, because they will give in to any available texts or messages from strangers online, I've been there with some beginners and they screamed how the hell they will know which is real or not.

But i don't agree with this, it's just like saying that Bitcoin/Crypto was meant for only people that are tech savvy. Mistakes are likely to happen but the wise ones learn from it. Although people who are tech savvy are at advantage cause can easily catch up but those who're not can learn to be security conscious, it's no crime to make mistakes as a beginner but like i said, "the wise ones learn from it.

[Hamza2424]

Exactly. It's a bummer, but at least the impact is limited.

I would say the data lost was not that limited bro, because almost 13,689 customers' data was lost who placed their order from May 10 and August 8 but this 90 days policy saved others from this breach, ShipMonk was the breaching point though, so they should work more on their security but Trezor from their end made sure that the data only sits there for 90 days, but I also heard that Trezor also keeps the invoice data for 10 years but in separate secured environment.

So others who bought wallets are still at risk of being breached if hackers find their way to that database. I hope they will never but there is always a risk so we should maintain proper privacy while buying these hardware wallets.

[Agathamay]

Thanks, OP, for sharing. Some people might not have access to this information if you have not shared it here.

this is a clear sign that, scammers are always working tirelessly and these scammers are most times very much informed  and that is why, everyone really needs to take their safety and security very serious because i have also come to realize no one is even above been scammed and this very phishing scam method have always been there and of recent i heard of a case where some group of scammers were caught impersonating the FBI and i was very concerned n how these people get to convince their victims and get to take money from the.

we should always try to verify every link and email we receive from official website else we might just fall victim of what we might not expect.

However, this attack is targeted, after Trezor's logistics partner, ShipMonk leaked shipping details of Trezors customers, and now the attackers actually know who has actually bought a Trezor device in the last 90 days.

The recipients of these phishing emails didn't do anything wrong to be targeted by these scammers. Their details were leaked from a third-party service provider. Trezor will ask for your details because third parties like ShipMonk will need them to send wallets to owners.

Some people become victims because of fear and poor judgment. When you receive such emails, don't panic or act out of fear. Acting calmly helps to make sound judgments.

I think for a novice investor, fear is almost inevitable and we wouldn't have to blame them entirely for it and you don't expect someone who might invested all their savings and suddenly get such an email to be calm, because what matters to them at that point, is to just secure their money and speaking with an acclaimed customer representative(scammer) seems much more easier for them until they realize they have given out everything to the scammer.

I still maintain the fact that, we shouldn't trust anyone in the internet and always do our best to verify every information we might get.